On Mon, 06 Sep 2010, Rodolfo Medina wrote:
To avoid that risk, would it be all right, from within hda6, just cd to hda8 and there perform writes?
It doesn't really matter from where you run the program, only where it writes to. And you must only write to another disk.
That said, it is better if you unmount the partition with deleted files, or at least remount it read-only. If it is busy, stop the processes that have open files in it (see lsof and fuser programs). While it may cause writes to the system, it's better that simply pull the power cord and risk file system corruption. And if programs are running, they might be writing files.
If it's the root partition, you'll need to reboot in another system, either from a CD (easiest way) or another system in your HD, if you have one.
Excuse so many questions, but the issue is a major one.
If it's major, why so much resistance in following the advice that has been given?
First, it seems you haven't yet unmounted the partition where files were deleted, even after some 24 hours of the problem. That should have been the first thing to do.
The easiest way to do that is turn off the system. (While not strictly necessary - the important bit is to unmount the partition with deleted files, since you'll be doing a reboot, it doesn't matter.) Download and burn a live CD, if necessary using another computer. If it already has the recovery program, it is easier, if not, select one that allows installing new packages from the live system (Ubuntu does, packages go in RAM filesystem.) Run the recovery program from the live CD on the partition. It may be that the program requires the partition to be unmounted, if not, and you must mount it, mount it as read-only. Let it run, and store the results somewhere else - another partition, another drive, pen drive, in another computer (via network, etc.)
--Don't know what time I'll be back, Mom. Probably soon after she throws me out.
Eduardo M KALINOWSKI eduardo@kalinowski.com.br